How is K8S_HOST_URL used and what needs it in EFK
First "K8S_HOST_URL" does not show up in elastic/elasticsearch, fluent/fluentd or elastic/kibana (the 3 projects from "EFK")
It does show up only in openshift/origin-aggregated-logging, which is the repo with the image definitions for the components of the logging stack as well as tools for building and deploying them.
So this seems to be how Openshift deploys its stack (through Kubernetes), which it will monitor (see "Collect and store Kubernetes events")
See also "mux-logging service" (still from openshift/origin-aggregated-logging):
Fluentd gets Kubernetes metadata to enrich each container log message with the namespace UUID, the pod UUID, and pod labels and annotations.
From RHEL
The environment variable K8S_HOST_URL in fluend is an internal url for reaching the master API. Not documented yet.